Dear Gioele,

I am currently on a mission to get sssd back into Debian testing,
currently blocked by:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522

The proposed fix for the above issue involves sudo becoming the
"owner" of the sudoers: entry in nsswitch.conf:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147179

The proposed fix in above bug report (adding debian/sudo.nss with
below content) does fail when upgrading sudo from a version of the
sudo package that did not have debian/sudo.nss, yet:

```
sudoers database-add

sudoers first files
```

When installing sudo a-fresh, with above sudo.nss file, "sudoers:
files" appears at the end of nsswitch.conf (GOOD). However, when
upgrading from an earlier version of the sudo package, we get
"sudoers:" in nsswitch.conf (BOOM). So, we end up in a broken state.

The fix for this needs to be applied to dh-nss, I guess:

```
diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss
dh-nss-1.7.1+nmu1/autoscripts/preinst-nss
--- dh-nss-1.7.1/autoscripts/preinst-nss	2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss	2026-09-16
16:05:08.000000000 +0200
@@ -1,4 +1,4 @@
-if [ "$1" = install ]; then
+if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E
#SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then
   	# Signal to postinst that the NSS services should be installed,
even if the package has been removed but not purged.
   	touch
"${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install"
   fi
diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog
--- dh-nss-1.7.1/debian/changelog	2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/debian/changelog	2026-09-16 16:05:25.000000000 +0200
@@ -1,3 +1,16 @@
+dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package
+    upgrade, too. (Closes: -1).
+    - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install
+      from preinst to postinst on package upgrades if SERVICE_PATTERN has not
+      been applied, yet.
+    - Assure SERVICE_PATTERN macro gets populated properly during preinst
+      autoscript generation.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Wed, 16 Sep 2026 16:05:25 +0200
+
   dh-nss (1.7.1) unstable; urgency=medium

     * t/dh_installnss: Fix typo
diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss
--- dh-nss-1.7.1/dh_installnss	2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/dh_installnss	2026-09-16 16:05:25.000000000 +0200
@@ -405,7 +405,9 @@
   	my $service_patterns_expr = service_patterns_expr(\%db_services);

   	# Add a snippet in preinst to detect installation of non-purged packages.
-	autoscript($package, "preinst", "preinst-nss");
+	autoscript($package, "preinst", "preinst-nss", {
+		"SERVICE_PATTERNS" => $service_patterns_expr,
+		});

   	# Generate one snippet for each extra NSS databases to be added.
   	foreach my $db_extra (@dbs_extra_add) {
```

Same .debdiff is attached. Please let us know if you see this as a
possible fix and if you can provide this change anytime soon.

Thanks,
Mike (and Marc, maintainer of sudo)